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DETAILED ACTION 

Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1,4, 9-14, 17, and 22-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over DiGiorgio et al., USPN 6,385,729 in view of Barlow et al., USPN 
6,038,551. 

With regard to claims 1, 9, 10, 12, 13, 14, 22, 23, 25, and 26, DiGiorgio discloses 
a system to uniquely identify a security computing device coupled to a computer 
(column 1 lines 7-9), the computer coupled to a server over a computer network 
(column 2 lines 3-8), the system including the security computing device being separate 
from the computer and adapted for connection by a user to the computer with an 
input/output (I/O) connector (column 2 lines 5-8), the security computing device 
including a processor and a secure memory (column 6 lines 30-33), the security 
computing device storing a serial number associated with the security computing device 
(column 10 lines 54-55) and a user key associated with the serial number that is unique 
to the security computing device in the secure memory (column 10 lines 35-36), a 
server coupled to a user information database, the user information database storing a 
plurality of registered serial numbers and a plurality of user keys, each user key being 
associated with one of the plurality of registered serial numbers, wherein, when the 
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computer attempts to log onto the server over the computer network, the server 
requests a serial number from the security computing device, the security computing 
device under the control of the processor to transmit the serial number from the secure 
memory, verifies whether the serial number received from the security computing device 
is stored as one of the plurality of registered serial numbers in the user information 
database, if the serial number is stored within the user information database, the server 
obtains the associated user key and computes a challenge and computes an expected 
response based on the associated user key (column 10 lines 54-60), the server sends 
the challenge to the security computing device over the computer network (column 10 
lines 30-33), wherein the security computing device under the control of the processor 
computes a response based upon a user key stored in the secure memory of the 
security computing device (column 10 lines 33-36), and if the server receives the 
response back from the security computing device in response to the challenge that 
matches the expected response, the server allows the computer to log onto the server 
(column 10 lines 43-44), DiGiorgio does not discloses the computer requesting an 
asset from the computer. Barlow discloses using an IC card to maintain secret 
cryptographic keys (column 1 lines 8-16). Barlow discloses receiving an asset and asset 
key encrypted with the user key of the IC card, column 17 line 59-column 18 line 8). It 
would have been obvious for one of ordinary skill in the art to send an asset from the 
ISP of DiGiorgio along with an encrypted asset key for the motivation of Barlow of 
keeping the IC keys secret (column 17 lines 52-55), and to minimize decryption 
processing of large assets. 
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With regard to claims 4 and 17, DiGiorgio does not go into detail of the challenge 
response process. The examiner takes official notice that hashing is a well-known way 
to perform challenge response authentication, since it is very hard to reverse engineer. 
It would have been obvious for one of ordinary skill in the art to use hashing to reveal 
the knowledge of a shared secret of DiGiorgio for the motivation of protecting the 
shared secret. 

With regard to claims 11 and 24, DiGiorgio in view of Barlow does not disclose 
renting or purchasing assets. The examiner takes official notice that it is well known in 
the art to rent and purchase assets through an ISP, and to indicate when a usage right 
expires. It would have been obvious for one of ordinary skill in the art to include an 
indication of rental or purchase in the encrypted asset of Barlow so the user would know 
the terms of usage. 

Conclusion 

3. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jacob Lipman whose telephone number is 571-272- 
3837. The examiner can normally be reached on M-Fr. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kambiz Zand can be reached on 571-272-381 1 . The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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